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DETAILED ACTION 

1 . This action is response to communication: response to RCE received 
07/17/2008, with arguments submitted on 09/19/2008. 

2. Claims 1-15 and 17-22 are currently pending in this application. Claims 1,10, 
and 17 are independent claims. 

3. No new IDS was received for this application. 

4. A request for continued examination under 37 CFR 1.114, including the fee set 
forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this 
application is eligible for continued examination under 37 CFR 1.114, and the fee set 
forth in 37 CFR 1 .17(e) has been timely paid, the finality of the previous Office action 
has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 
07/17/2008 has been entered. 

Response to Arguments 

Applicant's arguments with respect to the claims have been considered but are 
moot in view of the new ground(s) of rejection. 

Terminal Disclaimer 

5. The terminal disclaimer filed on 04/16/2007 disclaiming the terminal portion of 
any patent granted on this application which would extend beyond the expiration date of 
the full statutory term defined in 35 U.S.C. §1 54 to §1 56, and § 1 73 of any patent 
granted on Application No. 10/683,579, filed on October 9, 2007, has been reviewed 
and is NOT accepted. 
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a. The person who signed the terminal disclaimer is not recognized as an officer 
ofthe assignee, and he/she has not been established as being authorized to act 
on behalf of the assignee. See MPEP § 324. 

An attorney or agent, not of record, is not authorized to sign a terminal disclaimer 
in the capacity as an attorney or agent acting in a representative capacity as provided 
by 37 CFR 1 .34 (a). See 37 CFR 1 .321 (b) and/or (c). 

It would be acceptable for a person, other than a recognized officer, to sign a 
terminal disclaimer, provided the record for the application includes a statement that the 
person is empowered to sign terminal disclaimers and/or act on behalf of the 
organization. 

Accordingly, a new terminal disclaimer which includes the above empowerment 

statement will be considered to be signed by an appropriate official ofthe assignee. A 

separately filed paper referencing the previously filed terminal disclaimer and containing 

a proper empowerment statement would also be acceptable. 

It should be noted that applicant is not required to pay another disclaimer fee as set 

forth in 37 CFR 1 .20(d) when submitting a replacement or supplemental terminal 

disclaimer. 

Applicant's representative, specifically Rupak Nag (Agent Reg. No. 37493), is of 
record with the USPTO as an agent, and may not sign a terminal disclaimer. 
Accordingly, the terminal disclaimer is unacceptable and the double patenting rejection 
has not been overcome and is therefore maintained. 
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Double Patenting 

6. The nonstatutory double patenting rejection is based on a judicially created 
doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the 
unjustified or improper timewise extension of the "right to exclude" granted by a patent 
and to prevent possible harassment by multiple assignees. A nonstatutory obviousness- 
type double patenting rejection is appropriate where the conflicting claims are not 
identical, but at least one examined application claim is not patentably distinct from the 
reference claim(s) because the examined application claim is either anticipated by, or 
would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 
1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 
2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re 
Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 
164 USPQ 619 (CCPA 1970); and In re Thorington, 418 F.2d 528, 163 USPQ 644 
(CCPA 1969). 

A timely filed terminal disclaimer in compliance with 37 CFR 1 .321 (c) or 1 .321 (d) 
may be used to overcome an actual or provisional rejection based on a nonstatutory 
double patenting ground provided the conflicting application or patent either is shown to 
be commonly owned with this application, or claims an invention made as a result of 
activities undertaken within the scope of a joint research agreement. 
Effective January 1 , 1994, a registered attorney or agent of record may sign a terminal 



Application/Control Number: 10/684,330 Page 5 

Art Unit: 2134 

disclaimer. A terminal disclaimer signed by the assignee must fully comply with 37 CFR 
3.73(b). 



7. Claims 1 -15 and 17-22 are provisionally rejected on the ground of nonstatutory 
obviousness-type double patenting as being unpatentable over claims 1 -33 of 
copending Application No. 10683579 (hereinafter App. No '579). Although the conflicting 
claims are not identical, they are not patentably distinct from each other because 
Applicants' virus sensor operates in the same manner as the network virus/worm sensor 
in the copending Application. Considering claim 1 of the instant Application, the "switch" 
operation is later identified in claim 2 to be a function of the traffic controller whereas in 
copending App. No. '579 the limitation of the switching of modes as facilitated by the 
traffic controller is present in claim 1 along with the other functions of the network 
virus/worm sensor. 

This is a provisional obviousness-type double patenting rejection because the 
conflicting claims have not in fact been patented. 



8. Claims 1 -15 and 17-22 are provisionally rejected on the ground of nonstatutory 
obviousness-type double patenting as being unpatentable over claims 1 -33 of 
copending Application No. 10/683582 (hereinafter App. No '582). Although the 
conflicting claims are not identical, they are not patentably distinct from each other 
because Applicants' virus sensor operates in the same manner as the network 
virus/worm sensor in the copending Application. Further, the monitors in both 
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applications registers itself automatically to the network. Further, both the inventions 
teach a controller which provides a The present application further includes a limitation 
of a controlelr which provides a rule set and an outbreak prevent policy. However, it is 
well known in the field of network security that controllers provides specific rule sets to 
apply throughout the network, so as to synchronize all the monitors in the system. 

This is a provisional obviousness-type double patenting rejection because the 
conflicting claims have not in fact been patented. 



Claim Rejections - 35 USC §112 

9. The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

10. Claims 1-9, 15, and 22 are rejected under 35 U.S.C. 112, second paragraph, as 
being indefinite for failing to particularly point out and distinctly claim the subject matter 
which applicant regards as the invention. 

As per claims 1-9, 15, and 22, the claims recite "such that the bandwidth of a 
network is substantially unaffected." The term "substantial" is a term of degree, and it is 
unclear what the metes and bounds are of the limitations. 

As per claim 9, the claims recite "large selected files." The term "large" is an 
unclear amount, and it is unclear what the metes and bounds are of the limitations. 



Claim Rejections - 35 USC § 103 
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1 1 . The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

12. Claims 1-10, 13-15, 17, and 20-22 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Ramsey US Patent No. 7,331 ,061 (hereinafter Ramsey), in view of 
Douglas et al. US Patent No. 6,269,400 (hereinafter Douglas), and further in view of 
White et al. ("anatomy of a Commercial-Grade Immune System, IBM Research White 
Paper, 1999) (hereinafter White). 

As per claim 1 , Ramsey teaches in a distributed network of interconnected 
computing devices, a network virus monitor, comprising: a virus sensor operable in a 
number of modes arranged to detect a computer virus in the network such that the 
bandwidth of the network is substantially unaffected in a first mode in that data packets 
continue to their destination after they are copied creating copied data packets which 
are analyzed for the computer virus (col. 12 lines 43-56; col. 13 lines 4-18; col. 15 lines 
1-20; col. 16 lines 8-16; col. 18 line 17 to col. 19 line 34), and wherein when the virus 
sensor detects the computer virus, the virus sensor switches to a second mode, 
wherein original data packets are analyzed and a subset of data packets determined to 
be infected or suspected of being infected are not returned to the network (col. 12 lines 
43-56; col. 13 lines 4-18; col. 15 lines 1-20; col. 16 lines 8-16; col. 18 line 17 to col. 19 
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line 34), wherein the virus monitor receives a rule set (col. 12 liens 43-56; col. 16 lines 
8-16; col. 18 line 17 to col. 19 line 34). 

However, at the time of the invention, Ramsey does not teach all the limitations 
of the claims. These deficiencies are taught by Douglas though. Douglas teaches 
wherein the virus monitor is able to automatically collect network environment data and 
assign an IP address to itself, and wherein the virus monitor automatically locates a 
controller in the network and registers itself with the controller (col. 3 liens 28-49, and 
col. 4 lines 61-68). 

However, at the time of the invention, the Ramsey combination does not explicitly 
teach a controller providing an outbreak prevention policy. However, this is taught by 
White, such as in Figure 3, pages 13 and 14). 

At the time of the invention, it would have been obvious to one of ordinary skill in 
the art to combine the Ramsey reference with the Douglas reference. One of ordinary 
skill in the art would have been motivated to conduct automatically discovery and 
registration of available agents on a distributed network because it requires low CPU 
utilization and requires minimal programming of the agents (Douglas, col. 2 lines 38-39). 

At the time of the invention, it would have been obvious to one of ordinary skill in 
the art to combine the White reference with the Ramsey combination. One of ordinary 
skill in the art would have been motivated to perform such an addition to provide an 
immune system that can find, analyze, and cure previously unknown viruses faster than 
the viruses themselves can spread (White, page 2, first pagaraph, lines 1-2.). 
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As per claim 2, Ramsey teaches wherein a traffic controller coupled to the virus 
sensor and the network arranged to select certain data packets wherein the selected 
data packets are forwarded to the virus sensor (col. 5 lines 35-48; col. 12 liens 43-56; 
col. 13 lines 4-20; col. 15 liens 1-18; col. 16 lines 8-15), and throughout the reference. 

As per claim 3, Ramsey teaches wherein the traffic controller further comprises: 
a data packet copier operable in the first mode and arranged to generate a copied data 
packet of each of the selected data packets wherein the selected data packets are 
returned to the network (col. 13 lines 4-20) 

As per claim 4, Ramsey teaches wherein the data packet copier is disabled in the 
second mode such that the selected data packets are passed to the virus sensor 
(Figure 5; col. 15 lines 5-18) 

As per claim 5, Ramsey teaches a data packet protocol identifier coupled to the 
virus sensor arranged to identify a data packet protocol associated with the data packet 
infected by a computer virus (col. 4 lines 50-62; 10 lines 4-20). 

As per claim 6, Ramsey teaches wherein the selected data packets are each 
associated with the data pcket protocol associated with the computer virus such that 
only those data packets associated with the identified data packet protocol are selected 
from the network (col. 4 lines 50-62; col. 10 lines 4-20). 

As per claim 7, Ramsey teaches wherein the virus sensor unit further comprises 
a filescan module arranged to scan a selected file for the computer virus (col. 5 lines 55- 
66). 



Application/Control Number: 10/684,330 Page 10 

Art Unit: 2134 

As per claim 8, Ramsey teaches wherein the filescan is remotely located (col. 6 
liens 44-59). 

As per claim 9, Ramsey teaches wherein the remotely located filescan is used for 
scanning large selected files (col. 6 lines 44-59). 

Independent claim 10 is rejected using the same basis of arguments used to 
reject claim 1 above. 

Claim 13 is rejected using the same basis of arguments used to reject claim 3 

above. 

Claim 14 is rejected using the same basis of arguments used to reject claims 5 
and 6 above. 

Claim 15 is rejected using the same basis of arguments used to reject claim 1 

above. 

Claim 17 is rejected using the same basis of arguments used to reject claim 1 

above. 

Claim 20 is rejected using the same basis of arguments used to reject claim 13 

above. 

Claim 21 is rejected using the same basis of arguments used to reject claim 13 
and 14 above. 

Claim 22 is rejected using the same basis of arguments used to reject claim 15 

above. 
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13. Claims 1 1 , 12, 13, 18, and 19 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over the Ramsey combination as applied above, and further in view of 
Hypponen et al. in US PGPub No. 2003/0191957 (hereinafter Hyponnen), 

As per claim 1 1 , the Ramsey combination does not explicitly teach all the 
limitations of the claims. However, these are taught throughout Hyponnen. Hyponnen 
teaches isolating a portion of the network infected by the computer virus; and Cleaning 
the isolated portion of the network (paragraphs 15-18). 

At the time of the invention, it would have been obvious to include the Hypponen 
reference with the Ramsey combination. One of ordinary skill in the art would have 
been motivated to perform such an addition to create more security without slowing 
down the functions of the computer. (Hypponen paragraphs 4 and 5). 

As per claim 12, Hypponen teaches sending a virus report to a controller 
(paragraph 16-18) 

As per claim 13, Hyponnen teaches copying selected ones of the flow of data 
packets from 

Claim 18 is rejected using the same basis of arguments used to reject claim 12 
above. This is also taught throughout the Ramsey reference. 

Claim 19 is rejected using the same basis of arguments used to reject claim 13 

above. 



Conclusion 
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14. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Jason K. Gee whose telephone number is (571) 272- 
6431 . The examiner can normally be reached on M-F, 7:00 am to 4:30 pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kambiz Zand can be reached on (571 ) 272-381 1 . The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 

Jason Gee 
Patent Examiner 
Technology Center 2100 
09/26/2008 



/Kambiz Zand/ 

Supervisory Patent Examiner, Art Unit 2134 



